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ABSTRACT 

Previously the present protocol was referred as Yuen-Kim second version in our papers. In this paper, it 
is called Yuen protocol (Y-00) and we present an efficient implementation method of physical layer of Y-00 
which can support a secure communication and a quantum key distribution (more generally key expansion) 
by IMDD (intensity modulation/direct detection) or FSK(frequency shift keying)optical fiber communication 
network. Although the general proof of the security is not yet given, a brief sketch of security analysis is 
shown, which involve an entanglement attack. 
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1. INTRODUCTION 

A quantum key distribution for legitimate two users (Alice and Bob) is one of the most interesting subjects 
in quantum information science, which was pioneered by C.Bennett and G. Brassard in 1984[1]. In the 
original paper of Bennett, single photon communication was employed for implementation of quantum key 
distribution for simple explanation. However, despite that it is not essential in the great idea of Bennett, many 
researchers employed single photon communication scheme to realize BB84, B92[2]. There exist limitations 
of communications by single photon state or other quantum state(squeezed state and et al) with strong 
quantumness in the practical sense [3]. So it was discussed whether one can realize a secure key distribution 
guaranteed by quantum nature based on conventional light wave communication or not. One of the answers 
is that one employs coherent state as transmitter state, which has a semiclassical nature and a robustness 
for energy loss. Recently, as an example, an implementation of BB-84 by using continuous variable coherent 
state has been proposed [4], which may communicate more long distance and higher efficiency than single 
photon scheme. 

On the other hand, in the history of information theory, there were already several works on protocol 
with unconditionally secure communication. Let us introduce a short history on this subject. The most 
important problem is what is unconditional security. The condition of perfect secrecy I{X; C) = was 
given by Shannon. It means that the plaintext X and the cipher text C as a function of X and a secret 
key K should be statistically independent. He assumed in his model that Eve has access to precisely the 
same information as the legitimate user. As a result, a condition: H{X) < H{K) is required. It looks like 
impractical, because it means that perfect secrecy is achieved only when the secret key is at least as long as 
the plaintext message. However, such a pessimism was solved by introducing the modified Shannon's model 
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such that Eve cannot receive precisely the same information as Bob. There may be certain condition in 
physical world to realize the perfect secrecy. If we have no conditions for it, then it is called unconditionally 
secure scheme. In general, we can define a channel model of cipher communication or key distribution by 
the conventional information theory. That is, we have two channels. One is the channel from Alice to Bob, 
and the other is the channel from Alice to Eve. Let X, Y, Z be random variables of Alice, Bob, and Eve, 
respectively. The channel behavior is completely specified by the conditional probability P(Y, Z\X). For 
broadcast channels described by P{Y, Z\X), Wyner[5] clarified a fact that one can realize a scheme with 
unconditional security in which Eve is assumed to receive signals from Alice over a channel that is noisier 
than the legitimate users. Subsequently Csiszar-K6rner[6] generalized Wyner's result defining the secrecy 
capacity Cc{P{Y, Z\X)) which means that the maximum bits that Alice can send to Bob in secrecy. These 
schemes allow us realization of one way communication with confidential message X without initial key, 
and also distribution of key K. However, the assumption that Eve's channel is worse than the legitimate 
channel is also unrealistic. When the discussion is devoted to only the problem of key distribution, Maurer[7] 
pointed out that this assumption is not needed if the legitimate users can communicate over insecure but 
authenticated public channel like BB-84. Unfortunately the efficiency of communication is not so good, 
because it requires small SNR. In addition, in such information theoretical results, the problem of finding 
actual encodable and decodable codes that perform in a particular situation was remained. Yuen and Kim[8] 
showed that, using a protocol like B-92, a practical system with unconditional security can be realized if 
there exist some statistically independent noise or quantum shot noise in receivers of Eve and Bob, even the 
system is conventional fiber communication. It is called YK protocol. A simple experimental demonstration 
of YK protocol based on classical noise was reported [9]. Thus the unconditionally secure key distribution does 
not require a realization of single photon communications and also even quantum phenomena. These results 
verified that the key distribution with unconditional security is not proper matter of quantum theory. So one 
can realize unconditionally secure scheme by classical communication systems if there exist unavoidable noise 
such as "thermal noise in free space" and so on. In addition, H{X) < H{K) is not essential. However, these 
schemes are still ineflicient, because it requires small SNR also. One should investigate protocol with more 
high rate under high security. The best way may be that one seeks noisy channel governed by unavoidable 
quantum noise based on quantum mechanics. As a result, an interesting question arises " Is it possible to 
create a quantum system with current technology that could provide a communication in which always Bob's 
error probability is superior to that of Eve?" In 2000, Yuen gave a protocol(Y-OO) to realize it as a positive 
answer [10], in which he clarified a new scheme so called M-ary level cipher. This provides a theoretical basis 
for communication with confidential message for more general channel models including Wyner's broadcast 
channel, but it requires initial shared key between Alice and Bob. Furthermore, his scheme supports also 
secure key expansion, because the message can be replaced by random number. In proceedings paper of QCM 
and C 2002, an implementation method was shown by using conventional optical communication system[ll]. 
These results urged the problem of Wyner, Csiszar, Maurer to return from classical to quantum. It may be 
expected that it will open a new trend of quantum cryptography as a replacement of single photon scheme. 

Thus, the theory of quantum key expansion has been developed along two directions. One is to follow 

BB-84 and to give rigorous proof of security of BB-84 and B-92. The other is to follow a basic idea of Wyner 
and others for broadcast channels. Y-GG is close to the latter, but it is applicable to more general channels. 

In this paper, we will present an implementation method of physical layer for so called Y-00 protocol which 
supports a secure communication and a quantum key expansion applicable to IMDD (intensity modulation 

and direct detection) or FSK (frequency shift keying) fiber communication network with fiber amplifiers as 
optical repeater, and propose an error correction method to improve the performance of the total system. 

2. YUEN PROTOCOL:Y-00 

2.1. Basis of protocol 

It is well known that the no cloning theorem is not necessary condition for unconditionally secure key 
expansion in information theoretical cryptography, and it is only specific example of the realization. The 
general information theoretical condition for unconditional security was discussed in the field of information 



theory [5, 6]. Following this line, a physical cryptography by conventional optical communication was proposed 
by Yuen and Kim[8] which is called YK protocol. Let us here briefly introduce a development from YK 

protocol to Y-00 protocol. A fundamental idea of YK protocol comes from the next remark. 

Remark: If there are statistically independent noises between Eve and Bob, there exists a secure key expansion 

protocol based on communication. 

This is an idea along the concept of advantage distillation of Maurcr[7], and it is regarded as a method to 
realize a scheme such that a channel of legitimate risers is reliable than that of Alice and Eve, even the 
signal to noise ratio of Bob is less than that of Eve. Yuen and Kim emphasized that the essential point of 
security of the key distribution comes from detcctability of signals. This is quite different from the principle 
of BB-84, et al which are followed by the no cloning theorem. That is, BB-84 and related protocol employ a 
principle of unavoidable disturbance to quantum states to guarantee the security, but YK protocol employs 
a principle of communication theory to do so, and it can be realized as a modification of B-92 which has 
reconciliation protocol through a public channel. Although this can apply to long distance fiber system 
with optical repeaters, it cannot provide unconditional security when we extend communication distance and 
in some practical situations. Unfortunately, all of protocols proposed so far including the above scheme is 
inefficient for applying to commercial use. To cope with this defect, it was proposed [f 0] to use a fundamental 
theorem in quantum detection theory as follows[12]: 
Theorem 1: 

Signals with non commuting or the same density operators cannot be distinguished without error. 
This means that if we assign non commuting density operators for bit signals 1 and 0, then one cannot 
distinguish without error. When the error is 1/2 based on quantum noise, there is no way to distinguish 
them. So the problem is to create such a situation on the channel between Alice and Eve, but the channel of 
Alice and Bob is kept as a normal communication channel. To realize it, Yuen employed a combination of a 
shared short key scheme for the legitimate users and a stream cipher instead of reconciliation protocol. This 
realizes an advantage distillation. A crucial new ingredient in his protocol is the explicit use of a shared short 
key for cryptographic objective of secure communication and key expansion. We call it Yuen protocol(Y-OO). 

Let us here give a short survey of original protocol and physical layer of Y-00 as direct encription. 

(a) The sender (Alice) uses an explicit key (seed key:K, expanded into a long random running key:K* by use 
of pseudo random generator as a stream cipher) to modulate the parameters of a multimode coherent 
state. 

(b) State l^'o) = \a/V2)i ig) \a/V2)2 is prepared. Bit encoding can be represented as follows: 

1*6) = exp{-iJ^.^6}|*o) = \e-'*'^^a/V2)i \e'''''/^a/V2)2 (1) 
where Jz = {a\ai — a^i^'i)!'^- 

(c) Alice uses the running key K* to specify a basis from a set of M uniformly distributed two-mode coherent 
state. 

(d) The message X is encoded as Yk'{X). This mapping of the stream of bits is the key to be shared by 
Alice and Bob. Because of his knowledge K* , Bob can demodulate from Yk*{X) to X. 

In order to realize secure communication or to expand the key stream under secure way, we have to 
guarantee that Eve cannot obtain any information from the legitimate channel. They applied that the 
ciphering angle ipi, could have k in general as discrete or continuous variable determined by running key 
generated from pseudo random generator. A ciphered two mode state may be 

\^bk) = eyi^{-iJ^{(j)b + 0fc)}|«'o) (2) 

The corresponding density operator for all possible choices of k is pb, where 6 = 1 or 0, where pb are density 
operator for Eve, and mixed state consisting of two-mode coherent states. The problem for the security is to 



find the minimum error probability that Eve can achieve in bit determination. To find the optimum detection 
process for discrimination between p\ and po is a problem of quantum detection theory. The solution is given 



Here, {pi} are pure states for Bob, and are mixed states for Eve who has no initial key. As an example of 
encoding to create Pe{E) — > 1/2 which is the error probability of Eve, Yuen et al., used a scheme such that 
closest values of a given k can be associated with distinct bits from the bit at position k, and two closest 
neighboring states represent distinct bits which means a set of basis state. In this scheme, they assumed 
that one chooses a set of basis state(keying state for 1 and 0) for bits without overlap. As a result, the error 
probability for density operators pi and po becomes 1/2, when the number M of a set of basis state increases. 
Asymptotic property of the error probability depends on the amplitude(or energy) of coherent state. So one 
requires large number of M or modes when one wishes to extend the communication distance. Thus in this 
scheme Bob has always a better channel than Eve. This means the advantage distillation. 

2.2. Security analysis 

We clarify an intuitive proof of the security for Y-00 given by Yuen[23]. The security analysis of Y-00 is 

considered separately for secure direct encryption and key expansion. For direct encryption, the seed key:i^ 
is fixed and the running key.K* to modulate the optical modulator is constructed by blocks of bits of pseudo 
random number generated(PRG) by pseudo random number generator with the seed key. We assume that 
the PRG has sufficient properties for imiformness and so on. In this scheme, Eve cannot get information bits, 
because of from Eq(3). But she can try to get directly key information through the partial information of 
running key based on her observation of quantum states as basis in modulation. This corresponds to known 
plain-text attack in the conventional theory, because she attacks based on running key information which 
get from her observation for quantum states. The problem is how much accuracy for the observed data is 
possible for getting "running key". Since Eve has no a priori information on properties of random sequence 
as running key, she cannot apply several detection scheme known as correlation detections. So she has to 
employ optimum single shot detection scheme to get the most accurate data of each bit sequences. Let us 
consider a detection scheme based on individual quantum measurement and classical collective (or correlation) 
attack. We can evaluate the security by the quantum detection theory for quantum state signals which was 
formulated by Holeve and Yuen[12]. In our case, the detection limit is formulated by quantum minimax 
formula of Hirota-Ikehara[24]. 

[Quantum minirtiEix game between Alice and Eve] 



where pi are quantum states which represent the basis state in quantum M-ary cipher, {11} is positive operator 
valued measure(POVM) which correspond to receiver of Eve, pi is randomization probability of Alice. Finally 
the accuracy of Eve's data is given by the minimax value of this game. By this ultimate detection limit, Eve 
has to estimate the running key based on her data which involves error. If Eve can get the perfect information 
on running key, then the security level of this scheme is the same as the conventional stream cipher. Let n be 
length of the seed key. The security level of the ideal stream cipher is represented by 2" — 1. In general, the 
security level of conventional stream cipher is weaker than it. However, by quantum M-ary cipher, the data 
of Eve involve inherent error based on quantum noise. Here, if the number M is enough large, the equation 
(4) becomes P*e — 1. That is, the sequences of running key are truly randomized. Hence nobody can get the 
information on the correlation and others among the running key sequences from the observed data. So the 
legitimate users have almost secret channel which is guaranteed by the ultimate quantum detection limit. 

Thus, the security of classical stream cipher is enhanced by quantum M— ary cipher scheme. As a result. 
Eve cannot apply the conventional correlation attack and others for the structure of the generator. The 
possibility for Eve's strategy is only pure guess for all kind of key 2" — 1 which corresponds to Brute force 
attack, even the security of pseudo random number generator is weak. However, if Eve takes the strategy 



by [12] 



Pe = niin(piTr/9ino +poTrpoIli) 



(3) 




(4) 



of Brute force attack, then she needs complete cipher text. A trial to get cipher text is equivalent to the 
cipher text attack in this case. The problem is how to do such a cipher-text attack. First Eve has to clone 
the following sequence of quantum states 



l^-i) = {\ai)t\aj)2\akh . . . 



(5) 



then this sequence is copied as follows: 



= (|ai)i|a,)2|afc)3... 
1*2) = {\ai)i\aj)2\ak)z... 
1*3) = {Wi)\\Q-3)2\ak)3 ■ ■ ■ 



(6) 



and all sequences must be storagcd in quantum memory during the trial to check all kind of text. However, 
each quantum bits are non orthogonal {oii\aj) = 1, and also ^ 0. So the clone has error due to 

quantum no cloning theorem when M is enough large. As a result. Eve cannot get exact cipher-text. // 
the error is enough large, it is diffieult to apply the cipher-text attack, and also Brute force attack, because 
they would need a super exponential search. Thus, this scheme has almost perfect secrecy in the individual 
quantum measurement. For the case of the quantum collective measurement which will provide the same 
result, we will show in elsewhere. 

In the case of key expansion, the physical layer is the same as the case of direct encryption. The information 
data is replaced into the true random number, and they are divided to the blocks with length n. After 
communication of first blocks with length n, the legitimate users keep the block, and the seed key is refreshed 
by the bit block. Then the next random number with the length n is sent by the same physical process 
with refreshed seed key. They keep them and repeat the process. The bit strings(key) accumulated by the 
above communication are used as one time pad cipher. It is difficult to get the information for the block 
bit, because of the same reason for the case of the direct encryption. Since the seed key for M-ary cipher is 
always refreshed, this is stronger than the case of direct encription. Even if Eve can get some information 
in this case, the legitimate user can eliminate it by the privacy amplification. So finally the unconditional 
security for quantum individual, collective measurements, and classical collective attack will be shown. 



Analysis of security is an essential requirement for the discussion on cryptography. Various eavesdropping 
strategics have appeared in security analysis for BB-84, B-92[13-15]. A recent review is given by Gisin ct 
al[16]. However, these are not always effective for other scheme, and depend on protocols. Here we discuss 
on the security for the present model. There is no way for getting bit information in the scheme, because 
the error of Eve is always 1/2 for bit sequence. However, in quantum system, Eve can attack by methods as 
not only passive processing, but also active processing. For free space communication, one does not need to 
consider opaque attack and others, because the strategy of Eve is only to receive a piece of light wave from 
Alice. On the other hand, for fiber system, one has to consider various eavesdropping strategics in the same 
way as BB-84. One of them is entanglement attack. Although there are several variation of entanglement 
attack, here it is sufficient to consider the most simple one. That is, since the legitimate users do not use 
public channel in Y-00, we do not consider general attacks as conventional collective and joint attack. The 
entanglement attack in this case is that Eve entangles a separate probe with coherent states from Alice and 
detect the probe. After entanglement operation, Eve has to send the mode A which comes from Alice and 
keep the mode B as probe. When Bob measures them, some effects come from the action. Even if the 
effects act completely. Eve cannot get information of bit, because the each state has possibility of and l(see 
section 4). It helps Eve only for information of quantum states which was sent by Alice. If Eve can know all 
quantum state used by the legitimate users by such an entanglement attack, it reduces to classical stream 
cipher system. 



3. ENTANGLEMENT ATTACK 



Here we show that Eve also cannot get information of quantum state used by the legitimate users. To 
give a simple theory of entanglement for coherent state is worth while, because all information is transmitted 
by coherent state. Let T-La, and TLt be the Hilbcrt spaces of Eve and of the total signal plus probe system, 
respectively. If jaj), \(I>),U denote the signal, probe's initial states and the unitary interaction, respectively, 
then the state of the signal received by Bob is given by the density operator obtained by tracing out Eve's 
probe: 

PB=TrE{U\a,,ct>){c^^,4>\U^) (7) 

The unitary interaction operated by Eve should make the largest entanglement between the signals and 
probes. Hence it is reasonable to discuss the general properties of entanglement for coherent states. One 
of authors and van Enk gave a general analysis for entangled state of non orthogonal state like coherent 
state[17, 18]. Here we apply them to an evaluation of the security. The following quasi Bell states or unitary 
equivalence of them have good property for the entanglement. 

\^i)ab = hi{\a) a\ - ct) B + \ - a) A\a) b) 

|*2)ab = h2{\a) a\ - a) B - \ - a) A\a) b) /g-, 

|*3)ab = h3{\a)A\a)B + \-a)A\-a)B) 

|*4)ab = h4{\a)A\a)B - \ - a)A\ - a)B) 

where hi is normalized constant, a is coherent amplitude of light field. As remarkable property, |4'2)ab and 
|'J'4)ab have complete entanglement which is independent of a. The entangled states of other type have bad 
entanglement. If the amplitudes of mode A and mode B in the above form are different, the eigenvalues of 
the reduced density operator become 

^ {l + KA)il-KB) ^ {I-KaKI + Kb) , . 

2(1-kakb) ' 2{1 -kakb) 

where ka and kb are inner products of basis states in mode A and B, respectively. As a result, again we 
can see that degree of entanglement is maximum when ka = kb, because the von Neumann entropy as the 
measure of entanglement is maximum when Ai = A2 = 1/2. In addition, if the basis states are orthogonal, 
then it is easy to get complete entanglement. Furthermore, S.van Enk showed [18] that one cannot generate 
entangled coherent state with complete entanglement from coherent states of independent two modes, and that 
one cannot generate entangled coherent state with complete entanglement from incomplete entangled coherent 
state by local operation involving local filtering. 

Let us return to the discussion of the attacks. If Eve makes a scheme of the entanglement attack in 
front of the Bob's receiver, the states come from Alice are non orthogonal, because the signal power is very 
small. It becomes a problem of the generation of entangled state for non orthogonal states. Eve cannot get 
complete entanglement by her probe according to the above statement. But she can send a trick state which 
is generated by Eve herself. The amplitude of Alice's coherent state is one of M, so Eve does not know the 
amplitude of signals. As a result, she has to prepare the entangled coherent states with M amplitudes The 
probability for getting the appropriate entangled coherent state is order of 1/M^, in addition she cannot 
know which is the complete one. Thus, the information on the quantum states of Eve involves inherent error. 
In addition, if the channel involves optical amplifier as repeater, then the received states are mixed state. 
Eve cannot make a good entanglement operation in this case. 

If Eve makes the scheme at the Alice's side, then almost states are regarded as orthogonal, because the 
signal power is large. Let us show a property of dccohcrcncc due to energy loss on the state 1 5*2) as which 
has complete entanglement. Eve has the source of entangled state, keep one part and transmit the other part 
to Bob through a lossy channel. Bob will receive the attenuated optical state. This is a model for specific 
sharing method of entangled state. In such a situation, Eve can prepare the following entangled state 

|*2(0))ab = h*MA\ - ^)b - I - ")a|^)b) (10) 



where /12 = 1/ \/2(l — kakb), ka = {a\ — a), and kb = (-^1 — "^)) ^.nd where rj is transparency of the 
channel. When we employ a half mirror model for energy loss channel, the effect of energy loss is described 
by a linear coupling with an external vacuum field as follows: 



UBL\a)B\0)L = \^a)BW'^-m)L. (11) 

where the mode L is an external mode corresponding to energy loss, and a is taken as real. If we use 
l^ii^)) AB as the initial state, Alice will finally couple with the environment in 

Ia<^Ubl\^2{0))ab<^\0)l 
= h2{\a)A\ - a)B\ - V^a)z, - | - a)A\a)B\^a)L). (12) 

Then the state shared by Eve and Bob is given by a super operator calculation as follows: 

PAB = h2 {^|*2)ab(*2| 

+(1 - L){\a, -a)AB{-OL, a\ + \-a, cx)ab{ol, -a\)} (13) 

where 

I*2)ab = ^===(|a)A| - a)s - I - a)A\a)B), (14) 
V2(l - k\) 

- 2 

and where L = exp{— 4(1 — 77)|ap}, |a, —a)AB = |q;)a| — Q;)b, and /12 = 1/{2(1 — Lk^)}. As a result, we 
have the following form: 



+ -a)AB{-a,a\ + | - a,a)AB{a,-a\)} (15) 



Here let us discuss properties of entanglment of the above density operator. We can use the entangled 
fraction to measure the entanglement of mixed state. The fully entangled fraction of this density operator is 
given by 

f{pAB) =AB {^2\PAb\^2)aB (16) 

because |^2)^s has complete entanglement which is independent of a. As a result, we have 

fin ^_ (1-4) I {l-m-n\f 

In the special cases, the fraction of entanglement is that /{pab) = 1 for ry = 1, and /(pab) > '^'jii^ ~ '^a) 1*-"^ 
77 = 0. Although this is robust for energy loss compared with bi-photon entangled state, the entanglement is 
destroyed when 77 = 0. So it is useless in the sense for getting any information. 



4. QUANTUM M-ARY CIPHER FOR FIBER NETWORK 

An implementation of Y-00 in the above was discussed based on phase (or polarization)modulation which 

provides the same energy for bit [11]. To apply them to fiber communication system, it is better to realize 
them by intensity modulation/direct detection or frequency shift keying. But to keep the security, it will 
require some additional idea for implementation of Y-00. The essential role of modulation scheme in Y-00 is 
to assign non-commuting or same density operators to and 1 for Eve. In the original implementation[ll], 
they assumed that the selection of a set of the basis states to transmit and 1 is as follows 



{1, 0} - {|*i(l)), |*o(l))}, {|*i(2)), 1*0(2))}, . 



(18) 



Set of basis state 




2M 



Amplitude of coherent state 



Figure 1. Scheme of selection of quantum state parameters 



where {l^^iQ')), |^o(j))}i j G Al is a set of basis states. The bit or key information (1 and ) is transmitted 
by one of M sets of basis states, controUing by initial shared key and running key. This idea comes from 
a fundamental principle in quantum detection theory such that we can construct non-commuting density 
operators only by set of non-orthogonal states when one does not allow overlap of the selection of a set of 
basis state for 1 and 0. The non commutative nature of density operators depend on strongly on amplitude or 
energy of coherent state. In order to improve this effect, huge number of set of basis states must be prepared. 

On the other hand, when one allows overlap for selection of a set of basis state, it is easy to construct the 
same density operators for 1 and 0. That is, pi = po- This scheme is called overlap selection keying{OSK). 
As an advantage of the overlap selection keying, we can say that it provides a very simple system and Eve 
completely cannot estimate the bits at that time even if the set of the basis states is only one. Each set of 
basis state is used for {1,0}, and {0, 1}, depending on running key. 

Set Ai:0 \a{i)), 1 ^ |a(M+i)) (19) 

Set A2:0 ^ |a(M+i)), 1 ^ |a(i)) (20) 

So the density operators of 1 and for Eve are 

Pi= Po = ^(|a(i))(a(i)l + |a(M+i))(a(Af+i)|) (21) 

However, if the signal energy is large, the coherent states become of orthogonal. So bit strings that Eve 
observed are perfectly the same as those of Bob, though Eve cannot know information bit. This gives still 
insecure situation. In order to cope with the above problem, we employ a combination of M-ary scheme and 
overlap selection keying. As a result, the energy dependency of the security may be alleviated, and it is 
enough to take into account only the average error probability for discrimination of 2M pure states for the 
security. 

Here we show an example of design for IMDD system. Let us assume that the maximum amplitude is 
fixed as amax- We divide it into 2M. So we have M sets of basis state {(^1,^2), (Bi, B2), . . .}. Total set of 
basis state is given as shown in Fig.l. Here, let us assign and 1 by the same way as Eqs(19),(20) for the 
sets of {Bi,B2}, {Ci,C2},. ... In this case. Eve completely cannot get bit information, while the knowledge 
of Eve depends on amax and M in the original scheme[ll]. This fact gives a great advantage when we apply 
the Y-00 protocol to the practical system. Then she can try to know the information of quantum states 
used for bit transmission. This problem is of discrimination for 2M pure states. The error probability is 
given by Eq(4). Although we have many results for calculation of quantum optimum detection problems, to 
give the analytical solution of this problem is still difficult at present time, because the set of states does 
not have complete symmetric structure. However, the tight upper bound is given by applying square root 
measurement (SRM) to 2M pure states. It is well known that SRM provides the optimum or suboptimum 



detection for many kinds of pure state signals[19, 20]. The SRM is defined as foUows: 



\tii) = G-^^i), G=Y,\^i)m (22) 

where IV'i) is signal state, G is the Gram operator, and the detection operator is formed as 

Tii = \txi){ni\, ieM (23) 

It is very easy to calculate the average error probability when we apply this detection operator, and these are 
very tight which can be proven by Helstrom's Baycs cost reduction algorithm [21] to check the tightness (see 
Fig. 2). Thus if M increases, then her error for information on quantum states increases. In this case, pure 
guessing corresponds to ^yM^ ■ lower bound is given by the minimum error probability :P* (2) for signal 
set {|a(i)), |a(2))} which are neighboring states. It reads 

Pei2) = ^(1 - v/l-exp[-|a2-aiP]) (24) 

For the error probability of Bob, if we can allow Bob to use the quantum optimum receiver, then the error 
probability of Bob is independent of the number of set of basis state, and it is given as follows: 

Pe{B) = ^il-^l-\{a,\aM+i)n (25) 

We emphasize that Eve cannot get bit information in this stage, because the information for 1 and are 
modulated by the method of Eqs(19),(20). Wc will show the dctcctability for the case of conventional receiver 
in the next section. Thus, it is achieved that the error of Bob is less than that of Eve even the SNR of Eve 
is greater than that of Bob, which corresponds to the advantage distillation. Let us compare with non- 
overlap and overlap selection keying. In the former case. Eve will try to get bit information, so the density 
operators for Eve become mixed states pi, and po consisting of set of quantum states which send 1 and 0, 
respectively. The error probability of Eve for bit information (pi or po) depends on strongly power of laser 
light(see Fig 3). In the latter case, the error of Eve is always 1/2, and it dose not depend on power of laser 
light. On the information for set of basis states, the error probability of Eve becomes the same one given by 
the formulae Eq(4) in both cases. Thus in the latter case, it is enough to take the information on the set 
of basis states into account. Since, in the intensity modulation, we cannot keep the enough signal distance 
under the power constraint in comparison with phase modulation, the overlap selection keying has great 
advantage. In addition, it can send 2M bits by M sets of basis state. The above example was described as 
ASK(amplitude shift keying), but it is the same as the intensity modulation scheme. As simple modification, 
we can use frequency shift keying(FSK) and also combination of ASK and FSK. If one wishes more efficient 
scheme, then one can apply many modulation scheme, for instance Manchester scheme and so on. 

5. DESIGN FOR PRACTICAL FIBER NETWORK 

A special feature of YK and Y-00 protocol is that one can design the secure system based on only the abilities 
of Eve and Bob for detectability. That is, it is not important how many repeaters are used in communication 
channel from Alice to Bob. In general, the present fiber network consists of optical repeaters like fiber 
amplifier, and direct detection scheme(intensity detection for on and off). Although one can make the ability 
of Eve the level of pure guessing by increasing M(the number of basis set), it is difficult to improve the 
detectability of Bob when the communication distance is very long under the high bit rate, for example 1000 
km and 1 Gbps. Here we show how we can solve it. 

A practical fiber system consist of transmitter (laser diode), fiber cable, repeater(fiber amplifier), pre- 
amplifier, and photo-detector. The noise in receiver of the above scheme of IMDD is given as follows: 

{lon^) = {Ith) + {Isig") + ^hp") + {Isig-sp') + Wsp-sp') (26) 




Figure 3. Error probability of bit information for non overlap selection keying 



where {hh^), {Igig^), {hp^), {Isig-sp'^), {Isp-sp^) are thermal noise in detector, quantum shot noise, noise by 
spontaneous emission from ampUfier, beat noise between signal and spontaneous emission, beat noise between 
spontaneous emission itself, respectively. They are given as follows: 

= 2e'GpHr{n)B (27) 
{hp") = 2e^[KrGpN{G-l) + {Gp-l)]nspBSf (28) 

{Is^g^sp'') = 'ie^Gp[KrGpN{G-l) + {Gp-l)]Kr{n)nspB (29) 

{Isp-sp^} = 2e^[KrGpN{G-l) + {Gp-l)fnsp^BSf (30) 

where e is the electron charge, Gp is the gain of pre- amplifier, G = ^ is the gain of the repeater, Kr is the 
transparency of the fiber, A'' is the number of repeater, (n) is the photon number per second at transmitter, risp 
is the spontaneous emission factor, B is the bandwidth, and Sf is the bandwidth of optical filter, respectively. 
As a result, the bit sequence of Bob involves many error bits. That is, the error probability of Bob P^{B) in 
a real fiber system is not so good in comparison with quantum optimum receiver. 

P;(i?)»i(l-v'l-|(ai|aM+i)P) (31) 

Here we give a method for the improvement of this unavoidable error in the direct detection. Since we can use 
high bit rate(Gbps), it does not give a degradation of the performance even if we use redundant codewords 
for sending bit information(0 and 1). In the following we show how it works. Let us assign codeword:Mi from 
the set W : {ui € W} of the sequence of quantum states. For example, as error correction code, we assign 
one codeword from the following set of codewords: 



Codei 
Code2 
Codes 



{0 ^ Ml = |a(i))|a(i))|a(M+i)), 1 ^ U4 = |Q;(M+i))|Q;(M+i))|a(i))} 
{0 ^ ^2 = |Q!(i))|a(M+i))|Q:(i)), 1 ^ Us = |Q;(M+i))|a(i))|a(M+i))} 
{0 ^ Mg = |a(M+i))|a(i))|a(i))}, 1 ^ ue = |a(i))|a(M+i))|Q:(M+i))} 



(32) 



If the set A2 is chosen, then only bit and 1 arc changed, and the codeword is the same one. The structure 
of this codeword may be open for public, but the selection depends on initial key and running key. 

Let us recall that the decision of legitimate user is binary. For simplifying the evaluation, we assume that 
the probability distribution of noise in the detector for bit is symmetric. That is, the conditional probabilities 
for and 1 as the decision process are P(1|0) = P(0|1). Since the Hamming distance of this code is 3, it has 
a function of one bit error correction. So the average error probability is given as follows: 

Pe =3P(0|1)2-2P(0|1)3 (33) 

If the bit error: P(0|1) = 10"'' in the practical receiver of direct detection, then it turns the value of average 
error into about 10~* which is enough for practical use. This is effective rather than only to increase the 
transmitter energy of each light pulse for improving the error probability of Bob. 

The security for bit information is kept in the case of overlap selection keying, because it is independent 
of signal power. For information on the set of basis states which are used for sending bit sequence. Eve 
has to design the quantum optimum receiver applying to total number of pure quantum states as all kind 
of codewords Ui S W, because Eve cannot know them. In this case, the number of codeword is 3M. This 
corresponds to increasing the set of basis state. According to quantum detection theory and the numerical 
example of the error probability for M-ary pure states, the average error probability increases rapidly when 
the number M increases. 

In this section, we showed that if we insert key for the selection of codeword into Y-00 protocol, then we 
can improve the detectability of Bob without the degradation of the security. More general discussion for 
design of error correcting code will be given in the subsequent paper. 



6. CONCLUSIONS 



We repeat our motivation here. Basically, one wants to realize one way secure communication. However, the 
situation of the eavesdropper is in general better than the legitimate user. To cope with such a situation, 
many proposals were devoted to discuss only a key distribution which allow two way communication or 
feedback to establish the advantage distillation. BB-84 and other quantum key expansion protocols provided 
a solution for such problems, introducing to detect the existence of eavesdropper and privacy amplification. 

However, these may be unenterprising strategy in the practical system. Following such well known results, 
Yuen verified that more simple information theoretical secure communication and unconditionally secure key 
expansion exist. In this paper, we have shown an efficient physical layer of Y-00 protocol applicable to secure 
communication and quantum key expansion for fiber system. It was clarified that the overlap selection keying 
of set of basis states gives the very efficient way to establish the secure condition in Y-00 protocol. This work 
is an extension of reference 22. 
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